Hi,
Yes, this is possible - you can change the users collection while the user is running.
Alternatively, for slightly more advanced scenarios, you can easily implement a custom authentication provider that supplies custom authentication logic and bypasses the built-in users collection completely - see Custom authentication provider for details.